CVE-2024-23646

Packagist/pimcore/admin-ui-classic-bundle CVE-2024-23646: high 8.8, EPSS 1.00%

SQL Injection in Admin download files as zip

Action: Upgrade pimcore/admin-ui-classic-bundle to 1.3.2 or later.

composer require pimcore/admin-ui-classic-bundle:1.3.2

Affected

Fixed versions

Sources

• osv: GHSA-cwx6-4wmf-c6xv
• https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-cwx6-4wmf-c6xv
• https://nvd.nist.gov/vuln/detail/CVE-2024-23646
• https://github.com/pimcore/admin-ui-classic-bundle/commit/363afef29496cc40a8b863c2ca2338979fcf50a8
• https://github.com/pimcore/admin-ui-classic-bundle
• https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/Asset/AssetController.php#L2006
• https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/Asset/AssetController.php#L2087
• https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.3.2

CVE-2024-23646 · published 2024-01-24T20:54:15Z · modified 2026-09-10T03:49:59.705576221Z · JSON